Bug 75437 - fast/js/select-options-remove-gc.html crashes intermittently
Summary: fast/js/select-options-remove-gc.html crashes intermittently
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Andreas Kling
URL:
Keywords:
Depends on: 75769
Blocks:
  Show dependency tree / graph
 
Reported: 2012-01-02 08:37 PST by WebKit Review Bot
Modified: 2012-01-07 01:35 PST (History)
10 users (show)

See Also:

Attachments
Patch (8.46 KB, patch)
2012-01-03 15:53 PST, Andreas Kling 		no flags Details | Formatted Diff | Diff
Patch (7.63 KB, patch)
2012-01-03 15:54 PST, Andreas Kling 		andersca: review+
Details | Formatted Diff | Diff
Better patch (7.63 KB, patch)
2012-01-03 21:32 PST, Andreas Kling 		no flags Details | Formatted Diff | Diff
Better patch (55.92 KB, patch)
2012-01-03 21:33 PST, Andreas Kling 		sam: review+
Details | Formatted Diff | Diff
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description WebKit Review Bot 2012-01-02 08:37:16 PST 
"fast/js/select-options-remove-gc.html crashes intermittently on Chromium"
Requested by mwenge2 on #webkit.
Comment 1 Robert Hogan 2012-01-02 08:41:19 PST 
I can get it to crash twice in every ten runs with:

lucid Tools/Scripts/new-run-webkit-tests --chromium --iterations=100 fast/js/select-options-remove-gc.html

It occasionally crashes on the bots too:

http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fjs%2Fselect-options-remove-gc.html

http://build.webkit.org/results/Chromium%20Linux%20Release%20(Tests)/r103905%20(27679)/fast/js/select-options-remove-gc-crash-log.txt :

	base::debug::StackTrace::StackTrace() [0x5b727e]
	base::(anonymous namespace)::StackDumpSignalHandler() [0x5a00f9]
	0x7f71bf8e5af0
	0x9c9a10
	WebCore::HTMLSelectElement::optionToListIndex() [0x9c9cd5]
	WebCore::HTMLSelectElement::remove() [0x9ca396]
	WebCore::removeElement() [0x183cc4b]
	WebCore::V8HTMLOptionsCollection::removeCallback() [0x183b90f]
	v8::internal::Builtin_HandleApiCall() [0x67d48d]
	0x205cef404402
Comment 2 Robert Hogan 2012-01-02 08:42:56 PST 
I can reproduce this on Qt, so it's not port-specific.
Comment 3 Andreas Kling 2012-01-02 13:56:00 PST 
Taking, this has my ink all over it.
Comment 4 Andreas Kling 2012-01-03 15:53:11 PST 
Created attachment 121010 [details]
Patch
Comment 5 Andreas Kling 2012-01-03 15:54:20 PST 
Created attachment 121012 [details]
Patch
Comment 6 Alexey Proskuryakov 2012-01-03 16:29:43 PST 
As discussed on IRC, this fixes the wrong problem. We should make sure that reachable elements are not collected, not deal with the aftermath of GC.

How did this work in shipping WebKit?
Comment 7 Andreas Kling 2012-01-03 21:32:33 PST 
Created attachment 121057 [details]
Better patch

Reworked the HTMLCollection ownership model to ensure that collections keep their associated element alive.
Comment 8 Andreas Kling 2012-01-03 21:33:40 PST 
Created attachment 121058 [details]
Better patch
Comment 9 Andreas Kling 2012-01-05 22:45:06 PST 
Sam, would love your input on this.
Comment 10 Andreas Kling 2012-01-06 19:30:53 PST 
Committed r104373: <http://trac.webkit.org/changeset/104373>
Comment 11 Andreas Kling 2012-01-07 01:35:43 PST 
Committed r104383: <http://trac.webkit.org/changeset/104383>